ReDoS Vulnerability in Ruby Package: CVE-2021-41817
Summary
ALPINE-CVE-2021-41817: Date.parse in the date gem through 3.2.0 for Ruby allows ReDoS (regular expression Denial of Service) via a long string. Affects ruby versions < 2.7.5-r0. Fixed in 2.7.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ruby is a dynamic, open-source programming language with a focus on simplicity and productivity. It has an elegant syntax that is natural to read and easy to write. The Ruby package is widely used for web development, scripting, and data processing. However, it has been found to be vulnerable to a Regular Expression Denial of Service (ReDoS) attack through the date gem, affecting various versions of Ruby.
Vulnerability Detail
The vulnerability, identified as CVE-2021-41817, arises from the Date.parse method in the date gem, which allows attackers to exploit regular expressions. By sending a long string to the Date.parse method, an attacker can cause significant delays in processing, leading to a Denial of Service. This vulnerability affects Ruby versions up to 3.2.0, with potential ramifications including service outages and degraded performance.
How To Fix
Minimum fixed version
2.7.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade rubyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the Date.parse method with untrusted input. Validate and sanitize all input strings before processing them with this method to mitigate the risk of a ReDoS attack.
Conclusion
CVE-2021-41817 is a significant vulnerability in the Ruby programming language that can lead to Denial of Service attacks. It is crucial for developers to update their Ruby packages to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for ruby →
FAQ
CVE-2021-41817 is a vulnerability in the Ruby programming language that allows for a Regular Expression Denial of Service (ReDoS) attack through the date gem.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
The vulnerability can lead to service outages and degraded performance due to prolonged processing times caused by malicious input.
Ruby versions up to 3.2.0 are affected. The fixed versions are 3.2.1, 3.1.2, 3.0.2, and 2.0.1.
You can update your Ruby package using the command 'apk add ruby=3.2.1-r0' (or the appropriate fixed version) to ensure you are protected against this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for ruby.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
